Security Audit
dromo-automation
github.com/ComposioHQ/awesome-claude-skillsTrust Assessment
dromo-automation received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Excessive Permissions: Broad access to sensitive HR data via Dromo toolkit.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 17, 2026 (commit 99e2a295). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Excessive Permissions: Broad access to sensitive HR data via Dromo toolkit The skill grants the LLM broad and dynamic access to the Dromo HR platform through `RUBE_MULTI_EXECUTE_TOOL` and `RUBE_REMOTE_WORKBENCH`. Dromo is an HR system that typically manages highly sensitive employee data (e.g., PII, payroll, performance reviews). The skill encourages dynamic discovery of tools via `RUBE_SEARCH_TOOLS` and does not restrict the LLM to a predefined, safe subset of Dromo operations. This allows an attacker to craft prompts that could lead to unauthorized data access, modification, or exfiltration of sensitive HR information. Implement strict access controls and whitelisting for Dromo operations. Instead of dynamic tool discovery and execution, define a limited set of pre-approved, safe Dromo functions that the LLM is allowed to call. Ensure that any data retrieved from Dromo is filtered and sanitized before being presented to the user or used in further operations. Consider implementing human-in-the-loop approval for sensitive Dromo actions. | LLM | SKILL.md:49 |
Scan History
Embed Code
[](https://skillshield.io/report/64795a31e951e34b)
Powered by SkillShield